Spring Security 6 & JWT Authentication · Lesson

In-Memory User Authentication

Implement basic authentication using in-memory user details, configuring usernames, passwords, and roles directly.

In-Memory User Authentication is a free Spring Security 6 & JWT Authentication lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Spring Security 6 & JWT Authentication learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Welcome to In-Memory Auth

The fastest way to add real users: in-memory authentication. You define accounts straight in code — perfect for tests and tiny apps.

Why In-Memory Authentication?

In-memory authentication shines for prototyping, learning, and small apps where you don't need users persisted to a database.

Core: UserDetailsService

The UserDetailsService interface is the core of authentication — its job is to load user data. In-memory mode loads it from accounts you define in code.

Meet UserDetails

UserDetailsService returns a UserDetails object holding the username, an always-encoded password, and the authorities that define what the user can access.

Defining a User with Builder

Use User.builder() to create a UserDetails: set the username, an encoded password, and roles. The code shows a minimal user.

import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;

public class UserBuilderDemo {
    public static void main(String[] args) {
        // A PasswordEncoder is essential for security
        PasswordEncoder passwordEncoder = new BCryptPasswordEncoder();

        UserDetails user = User.builder()
            .username("alice")
            .password(passwordEncoder.encode("secret")) // Encode the password!
            .roles("USER") // Short for ROLE_USER
            .build();

        System.out.println("Username: " + user.getUsername());
        System.out.println("Password (encoded): " + user.getPassword());
        System.out.println("Authorities: " + user.getAuthorities());
    }
}

The InMemoryUserDetailsManager

The InMemoryUserDetailsManager is the default UserDetailsService for in-memory auth, storing your UserDetails in a simple map. Pass users to its constructor.

import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;

public class InMemoryManagerDemo {
    public static void main(String[] args) {
        PasswordEncoder passwordEncoder = new BCryptPasswordEncoder();

        UserDetails user1 = User.builder()
            .username("bob")
            .password(passwordEncoder.encode("pass123"))
            .roles("USER")
            .build();

        UserDetails admin = User.builder()
            .username("admin")
            .password(passwordEncoder.encode("adminpass"))
            .roles("ADMIN", "USER") // Multiple roles
            .build();

        // Create the manager with our users
        InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager(user1, admin);

        // Try to load a user
        System.out.println("Loaded user: " + manager.loadUserByUsername("bob").getUsername());
        System.out.println("Loaded admin: " + manager.loadUserByUsername("admin").getUsername());
    }
}

Configuring the Manager Bean

In Boot, expose the InMemoryUserDetailsManager as a @Bean and Spring picks it up automatically. Just remember to also provide a PasswordEncoder bean.

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;

@Configuration
public class SimpleSecurityConfig {

    @Bean
    public UserDetailsService inMemoryUsers(PasswordEncoder passwordEncoder) {
        UserDetails user = User.builder()
            .username("tester")
            .password(passwordEncoder.encode("testpass"))
            .roles("VIEWER")
            .build();
        return new InMemoryUserDetailsManager(user);
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    // Other HttpSecurity configurations would go here...
}

Roles vs. Authorities

Use roles and Spring auto-prefixes them with ROLE_ (USER becomes ROLE_USER). For fine-grained permissions, .authorities() takes the full string as-is.

Multiple Users and Roles

Add as many in-memory users as you need, each with different roles, to test access-control scenarios — just pass more UserDetails to the manager.

Quick Check

You've learned how to set up users in memory. Which Spring Security component is specifically used to manage and retrieve these in-memory user details?

Recap: In-Memory Auth

Recap: in-memory authentication lets you define users via User.builder(), store them in InMemoryUserDetailsManager, encode passwords, and assign roles.

Frequently asked questions

Is the “In-Memory User Authentication” lesson free?

Yes — the full text of “In-Memory User Authentication” is free to read here on the web, and the Spring Security 6 & JWT Authentication course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Spring Security 6 & JWT Authentication course, upgrade to CoddyKit PRO.

What will I learn in “In-Memory User Authentication”?

Implement basic authentication using in-memory user details, configuring usernames, passwords, and roles directly. You practise Spring Security 6 & JWT Authentication with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Spring Security 6 & JWT Authentication?

No prior experience is required. Spring Security 6 & JWT Authentication on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “In-Memory User Authentication” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Spring Security 6 & JWT Authentication lesson?

Yes. Every Spring Security 6 & JWT Authentication lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

Introduction to Spring Security 6
Project Setup and Dependencies
In-Memory User Authentication
Understanding the Spring Security Filter Chain

← Back to Spring Security 6 & JWT Authentication